* User login events. Note that there is no login/logout system call to intercept. login/logout may have to be determined by monitoring setuid32 / exit from /bin/login
* Change to facilitate IPv6 addresses.
